Hybrid work is here to stay, and so are the risks that come with it: home networks you don't control, devices that leave the office, and staff who can't lean over and ask IT if an email looks odd. This checklist covers what leaders should expect to have in place.
Identity and access
- Multi-factor authentication for every account that can be reached from the internet.
- Access to systems and data based on role, reviewed regularly.
- Accounts disabled on an employee's last day — not weeks later.
Devices
- Company devices managed centrally, with automatic updates.
- Full-disk encryption, so a lost laptop isn't a data breach.
- Endpoint protection on every device that touches company data.
- A clear policy on personal devices: what they can access, and what protections are required.
Connections
- Secure remote access to internal systems, never exposed directly to the internet.
- Simple guidance for home networks: change default router passwords, keep firmware updated, use a separate network for smart devices where possible.
- Caution with public Wi-Fi for sensitive work.
Data and collaboration
- Approved tools for file sharing and messaging, so data doesn't scatter across personal accounts.
- Sharing links that expire and can't be forwarded freely.
- Backups of cloud data such as email and shared files.
People
- Regular, short security awareness training.
- A one-click way to report suspicious email, and a fast response when someone does.
- A clear process for lost or stolen devices, and a number to call at any hour.
Questions to ask your team
- If a laptop were left in a taxi tonight, what would happen — and what could someone access?
- How quickly is access removed when someone leaves?
- Can every remote connection be traced to a named person and a managed device?